Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

Cybersecurity researchers have flagged yet another evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware family that has compromised a new set of npm packages, even as it has propagated to the Go ecosystem. "The latest activity includes malicious npm releases affecting LeoPlatform and RStreams packages, GitHub Actions workflow abuse, and a related Go

The report describes a supply-chain malware campaign that compromised npm packages, abused GitHub Actions workflows, and spread into the Go ecosystem through the Mini Shai-Hulud/Miasma/Hades malware family. Other sources confirm the broader campaign involved self-propagating npm infections, credential theft, and CI/CD persistence, with malicious package releases affecting Red Hat–related npm packages and related build pipelines.[1][2][3][4] From a CyberSE.AI perspective, this is a high-priority AI supply chain risk because the attack pattern can contaminate development dependencies, automation credentials, and software delivery workflows, which can also impact AI-assisted build and release environments if they rely on the affected packages or tokens.[1][2][6][7]